It is a kind of moonshot feature to consider.

• Agents connect to Kafka and identify themselves as name and a set of labels there, but they do not connect to the master on their own
• Master has Cloud API implementation for Remoting Kafka
• When Jenkins task queue requires a node provisioning, Remoting kafka plugin queries agents for matching levels over a Kafka request
• If there is an agent with proper labels, Jenkins master connects to the agent and "provisions" the agent